notionnext-org NotionNext Authentication Guard cache.js cleanCache missing authentication
A security vulnerability has been detected in notionnext-org NotionNext up to 4.10.10. Affected by this issue is the function cleanCache of the file pages/api/cache.js of the component Authentication Guard. The manipulation of the argument token leads to missing authentication. The attack may be initiated remotely. Versions 4.1.0 - 4.9.5.2 allow unauthenticated exploitation due to missing method check. In versions 4.9.5.7 - 4.10.10 a guard present but only enforced when CACHE_REVALIDATION_TOKEN is set. Default deployments remain unprotected. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-101004
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-101004
NotionNext
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"cpes": [
"cpe:2.3:a:notionnext-org:notionnext:*:*:*:*:*:*:*:*"
],
"vendor": "notionnext-org",
"modules": [
"Authentication Guard"
],
"product": "NotionNext",
"versions": [
{
"status": "affected",
"version": "4.10.0"
},
{
"status": "affected",
"version": "4.10.1"
},
{
"status": "affected",
"version": "4.10.2"
},
{
"status": "affected",
"version": "4.10.3"
},
{
"status": "affected",
"version": "4.10.4"
},
{
"status": "affected",
"version": "4.10.5"
},
{
"status": "affected",
"version": "4.10.6"
},
{
"status": "affected",
"version": "4.10.7"
},
{
"status": "affected",
"version": "4.10.8"
},
{
"status": "affected",
"version": "4.10.9"
},
{
"status": "affected",
"version": "4.10.10"
}
]
}
]- Related CVEs
- CVE-2026-101004
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #3028 · Revision 1
- Added to Heist Feed
- Publisher date